text:
(a) Except as otherwise provided in subdivision (d), if a business has an established business relationship with a customer and has within the immediately preceding calendar year disclosed personal information that corresponds to any of the categories of personal information set forth in paragraph (6) of subdivision (e) to third parties, and if the business knows or reasonably should know that the third parties used the personal information for the third parties’ direct marketing purposes, that business shall, after the receipt of a written or electronic mail request, or, if the business chooses to receive requests by toll-free telephone or facsimile numbers, a telephone or facsimile request from the customer, provide all of the following information to the customer free of charge:

(1) In writing or by electronic mail, a list of the categories set forth in paragraph (6) of subdivision (e) that correspond to the personal information disclosed by the business to third parties for the third parties’ direct marketing purposes during the immediately preceding calendar year.

(2) In writing or by electronic mail, the names and addresses of all of the third parties that received personal information from the business for the third parties’ direct marketing purposes during the preceding calendar year and, if the nature of the third parties’ business cannot reasonably be determined from the third parties’ name, examples of the products or services marketed, if known to the business, sufficient to give the customer a reasonable indication of the nature of the third parties’ business.

(b) (1) A business required to comply with this section shall designate a mailing address, electronic mail address, or, if the business chooses to receive requests by telephone or facsimile, a toll-free telephone or facsimile number, to which customers may deliver requests pursuant to subdivision (a). A business required to comply with this section shall, at its election, do at least one of the following:

(A) Notify all agents and managers who directly supervise employees who regularly have contact with customers of the designated addresses or numbers or the means to obtain those addresses or numbers and instruct those employees that customers who inquire about the business’s privacy practices or the business’s compliance with this section shall be informed of the designated addresses or numbers or the means to obtain the addresses or numbers.

(B) Add to the home page of its Web site a link either to a page titled “Your Privacy Rights” or add the words “Your Privacy Rights” to the home page’s link to the business’s privacy policy. If the business elects to add the words “Your Privacy Rights” to the link to the business’s privacy policy, the words “Your Privacy Rights” shall be in the same style and size as the link to the business’s privacy policy. If the business does not display a link to its privacy policy on the home page of its Web site, or does not have a privacy policy, the words “Your Privacy Rights” shall be written in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the language. The first page of the link shall describe a customer’s rights pursuant to this section and shall provide the designated mailing address, e-mail address, as required, or toll-free telephone number or facsimile number, as appropriate. If the business elects to add the words “Your California Privacy Rights” to the home page’s link to the business’s privacy policy in a manner that complies with this subdivision, and the first page of the link describes a customer’s rights pursuant to this section, and provides the designated mailing address, electronic mailing address, as required, or toll-free telephone or facsimile number, as appropriate, the business need not respond to requests that are not received at one of the designated addresses or numbers.

(C) Make the designated addresses or numbers, or means to obtain the designated addresses or numbers, readily available upon request of a customer at every place of business in California where the business or its agents regularly have contact with customers.

The response to a request pursuant to this section received at one of the designated addresses or numbers shall be provided within 30 days. Requests received by the business at other than one of the designated addresses or numbers shall be provided within a reasonable period, in light of the circumstances related to how the request was received, but not to exceed 150 days from the date received.

(2) A business that is required to comply with this section and Section 6803 of Title 15 of the United States Code may comply with this section by providing the customer the disclosure required by Section 6803 of Title 15 of the United States Code, but only if the disclosure also complies with this section.

(3) A business that is required to comply with this section is not obligated to provide information associated with specific individuals and may provide the information required by this section in standardized format.

(c) (1) A business that is required to comply with this section is not obligated to do so in response to a request from a customer more than once during the course of any calendar year. A business with fewer than 20 full-time or part-time employees is exempt from the requirements of this section.

(2) If a business that is required to comply with this section adopts and discloses to the public, in its privacy policy, a policy of not disclosing personal information of customers to third parties for the third parties’ direct marketing purposes unless the customer first affirmatively agrees to that disclosure, or of not disclosing the personal information of customers to third parties for the third parties’ direct marketing purposes if the customer has exercised an option that prevents that information from being disclosed to third parties for those purposes, as long as the business maintains and discloses the policies, the business may comply with subdivision (a) by notifying the customer of his or her right to prevent disclosure of personal information, and providing the customer with a cost-free means to exercise that right.

(d) The following are among the disclosures not deemed to be disclosures of personal information by a business for a third party’s direct marketing purposes for purposes of this section:

(1) Disclosures between a business and a third party pursuant to contracts or arrangements pertaining to any of the following:

(A) The processing, storage, management, or organization of personal information, or the performance of services on behalf of the business during which personal information is disclosed, if the third party that processes, stores, manages, or organizes the personal information does not use the information for a third party’s direct marketing purposes and does not disclose the information to additional third parties for their direct marketing purposes.

(B) Marketing products or services to customers with whom the business has an established business relationship where, as a part of the marketing, the business does not disclose personal information to third parties for the third parties’ direct marketing purposes.

(C) Maintaining or servicing accounts, including credit accounts and disclosures pertaining to the denial of applications for credit or the status of applications for credit and processing bills or insurance claims for payment.

(D) Public record information relating to the right, title, or interest in real property or information relating to property characteristics, as defined in Section 408.3 of the Revenue and Taxation Code, obtained from a governmental agency or entity or from a multiple listing service, as defined in Section 1087, and not provided directly by the customer to a business in the course of an established business relationship.

(E) Jointly offering a product or service pursuant to a written agreement with the third party that receives the personal information, provided that all of the following requirements are met:

(i) The product or service offered is a product or service of, and is provided by, at least one of the businesses that is a party to the written agreement.

(ii) The product or service is jointly offered, endorsed, or sponsored by, and clearly and conspicuously identifies for the customer, the businesses that disclose and receive the disclosed personal information.

(iii) The written agreement provides that the third party that receives the personal information is required to maintain the confidentiality of the information and is prohibited from disclosing or using the information other than to carry out the joint offering or servicing of a product or service that is the subject of the written agreement.

(2) Disclosures to or from a consumer reporting agency of a customer’s payment history or other information pertaining to transactions or experiences between the business and a customer if that information is to be reported in, or used to generate, a consumer report as defined in subdivision (d) of Section 1681a of Title 15 of the United States Code, and use of that information is limited by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.).

(3) Disclosures of personal information by a business to a third party financial institution solely for the purpose of the business obtaining payment for a transaction in which the customer paid the business for goods or services with a check, credit card, charge card, or debit card, if the customer seeks the information required by subdivision (a) from the business obtaining payment, whether or not the business obtaining payment knows or reasonably should know that the third party financial institution has used the personal information for its direct marketing purposes.

(4) Disclosures of personal information between a licensed agent and its principal, if the personal information disclosed is necessary to complete, effectuate, administer, or enforce transactions between the principal and the agent, whether or not the licensed agent or principal also uses the personal information for direct marketing purposes, if that personal information is used by each of them solely to market products and services directly to customers with whom both have established business relationships as a result of the principal and agent relationship.

(5) Disclosures of personal information between a financial institution and a business that has a private label credit card, affinity card, retail installment contract, or cobranded card program with the financial institution, if the personal information disclosed is necessary for the financial institution to maintain or service accounts on behalf of the business with which it has a private label credit card, affinity card, retail installment contract, or cobranded card program, or to complete, effectuate, administer, or enforce customer transactions or transactions between the institution and the business, whether or not the institution or the business also uses the personal information for direct marketing purposes, if that personal information is used solely to market products and services directly to customers with whom both the business and the financial institution have established business relationships as a result of the private label credit card, affinity card, retail installment contract, or cobranded card program.

(e) For purposes of this section, the following terms have the following meanings:

(1) “Customer” means an individual who is a resident of California who provides personal information to a business during the creation of, or throughout the duration of, an established business relationship if the business relationship is primarily for personal, family, or household purposes.

(2) “Direct marketing purposes” means the use of personal information to solicit or induce a purchase, rental, lease, or exchange of products, goods, property, or services directly to individuals by means of the mail, telephone, or electronic mail for their personal, family, or household purposes. The sale, rental, exchange, or lease of personal information for consideration to businesses is a direct marketing purpose of the business that sells, rents, exchanges, or obtains consideration for the personal information. “Direct marketing purposes” does not include the use of personal information (A) by bona fide tax exempt charitable or religious organizations to solicit charitable contributions, (B) to raise funds from and communicate with individuals regarding politics and government, (C) by a third party when the third party receives personal information solely as a consequence of having obtained for consideration permanent ownership of accounts that might contain personal information, or (D) by a third party when the third party receives personal information solely as a consequence of a single transaction where, as a part of the transaction, personal information had to be disclosed in order to effectuate the transaction.

(3) “Disclose” means to disclose, release, transfer, disseminate, or otherwise communicate orally, in writing, or by electronic or any other means to any third party.

(4) “Employees who regularly have contact with customers” means employees whose contact with customers is not incidental to their primary employment duties, and whose duties do not predominantly involve ensuring the safety or health of the business’s customers. It includes, but is not limited to, employees whose primary employment duties are as cashier, clerk, customer service, sales, or promotion. It does not, by way of example, include employees whose primary employment duties consist of food or beverage preparation or service, maintenance and repair of the business’s facilities or equipment, direct involvement in the operation of a motor vehicle, aircraft, watercraft, amusement ride, heavy machinery or similar equipment, security, or participation in a theatrical, literary, musical, artistic, or athletic performance or contest.

(5) “Established business relationship” means a relationship formed by a voluntary, two-way communication between a business and a customer, with or without an exchange of consideration, for the purpose of purchasing, renting, or leasing real or personal property, or any interest therein, or obtaining a product or service from the business, if the relationship is ongoing and has not been expressly terminated by the business or the customer, or if the relationship is not ongoing, but is solely established by the purchase, rental, or lease of real or personal property from a business, or the purchase of a product or service, and no more than 18 months have elapsed from the date of the purchase, rental, or lease.

(6) (A) The categories of personal information required to be disclosed pursuant to paragraph (1) of subdivision (a) are all of the following:

(i) Name and address.

(ii) Electronic mail address.

(iii) Age or date of birth.

(iv) Names of children.

(v) Electronic mail or other addresses of children.

(vi) Number of children.

(vii) The age or gender of children.

(viii) Height.

(ix) Weight.

(x) Race.

(xi) Religion.

(xii) Occupation.

(xiii) Telephone number.

(xiv) Education.

(xv) Political party affiliation.

(xvi) Medical condition.

(xvii) Drugs, therapies, or medical products or equipment used.

(xviii) The kind of product the customer purchased, leased, or rented.

(xix) Real property purchased, leased, or rented.

(xx) The kind of service provided.

(xxi) Social security number.

(xxii) Bank account number.

(xxiii) Credit card number.

(xxiv) Debit card number.

(xxv) Bank or investment account, debit card, or credit card balance.

(xxvi) Payment history.

(xxvii) Information pertaining to the customer’s creditworthiness, assets, income, or liabilities.

(B) If a list, description, or grouping of customer names or addresses is derived using any of these categories, and is disclosed to a third party for direct marketing purposes in a manner that permits the third party to identify, determine, or extrapolate any other personal information from which the list was derived, and that personal information when it was disclosed identified, described, or was associated with an individual, the categories set forth in this subdivision that correspond to the personal information used to derive the list, description, or grouping shall be considered personal information for purposes of this section.

(7) “Personal information” as used in this section means any information that when it was disclosed identified, described, or was able to be associated with an individual and includes all of the following:

(A) An individual’s name and address.

(B) Electronic mail address.

(C) Age or date of birth.

(D) Names of children.

(E) Electronic mail or other addresses of children.

(F) Number of children.

(G) The age or gender of children.

(H) Height.

(I) Weight.

(J) Race.

(K) Religion.

(L) Occupation.

(M) Telephone number.

(N) Education.

(O) Political party affiliation.

(P) Medical condition.

(Q) Drugs, therapies, or medical products or equipment used.

(R) The kind of product the customer purchased, leased, or rented.

(S) Real property purchased, leased, or rented.

(T) The kind of service provided.

(U) Social security number.

(V) Bank account number.

(W) Credit card number.

(X) Debit card number.

(Y) Bank or investment account, debit card, or credit card balance.

(Z) Payment history.

(AA) Information pertaining to creditworthiness, assets, income, or liabilities.

(8) “Third party” or “third parties” means one or more of the following:

(A) A business that is a separate legal entity from the business that has an established business relationship with a customer.

(B) A business that has access to a database that is shared among businesses, if the business is authorized to use the database for direct marketing purposes, unless the use of the database is exempt from being considered a disclosure for direct marketing purposes pursuant to subdivision (d).

(C) A business not affiliated by a common ownership or common corporate control with the business required to comply with subdivision (a).

(f) (1) Disclosures of personal information for direct marketing purposes between affiliated third parties that share the same brand name are exempt from the requirements of paragraph (1) of subdivision (a) unless the personal information disclosed corresponds to one of the following categories, in which case the customer shall be informed of those categories listed in this subdivision that correspond to the categories of personal information disclosed for direct marketing purposes and the third party recipients of personal information disclosed for direct marketing purposes pursuant to paragraph (2) of subdivision (a):

(A) Number of children.

(B) The age or gender of children.

(C) Electronic mail or other addresses of children.

(D) Height.

(E) Weight.

(F) Race.

(G) Religion.

(H) Telephone number.

(I) Medical condition.

(J) Drugs, therapies, or medical products or equipment used.

(K) Social security number.

(L) Bank account number.

(M) Credit card number.

(N) Debit card number.

(O) Bank or investment account, debit card, or credit card balance.

(2) If a list, description, or grouping of customer names or addresses is derived using any of these categories, and is disclosed to a third party or third parties sharing the same brand name for direct marketing purposes in a manner that permits the third party to identify, determine, or extrapolate the personal information from which the list was derived, and that personal information when it was disclosed identified, described, or was associated with an individual, any other personal information that corresponds to the categories set forth in this subdivision used to derive the list, description, or grouping shall be considered personal information for purposes of this section.

(3) If a business discloses personal information for direct marketing purposes to affiliated third parties that share the same brand name, the business that discloses personal information for direct marketing purposes between affiliated third parties that share the same brand name may comply with the requirements of paragraph (2) of subdivision (a) by providing the overall number of affiliated companies that share the same brand name.

(g) The provisions of this section are severable. If any provision of this section or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.

(h) This section does not apply to a financial institution that is subject to the California Financial Information Privacy Act (Division 1.2 (commencing with Section 4050) of the Financial Code) if the financial institution is in compliance with Sections 4052, 4052.5, 4053, 4053.5, and 4054.6 of the Financial Code, as those sections read when they were chaptered on August 28, 2003, and as subsequently amended by the Legislature or by initiative.

(i) This section shall become operative on January 1, 2005.

history: (History: Amended by Stats. 2005, Ch. 22, Sec. 16. Effective January 1, 2006.)

title: 1.81. CUSTOMER RECORDS


kind: section

code: CIV

text:
(a) The purpose of this section is to ensure that information obtained on an Internet Web site regarding an individual’s age will not be used in furtherance of employment or age discrimination.

(b) A commercial online entertainment employment service provider that enters into a contractual agreement to provide employment services to an individual for a subscription payment shall not, upon request by the subscriber, do either of the following:

(1) Publish or make public the subscriber’s date of birth or age information in an online profile of the subscriber.

(2) Share the subscriber’s date of birth or age information with any Internet Web sites for the purpose of publication.

(c) A commercial online entertainment employment service provider subject to subdivision (b) shall, within five days, remove from public view in an online profile of the subscriber the subscriber’s date of birth and age information on any companion Internet Web sites under its control upon specific request by the subscriber naming the Internet Web sites. A commercial online entertainment employment service provider that permits members of the public to upload or modify Internet content on its own Internet Web site or any Internet Web site under its control without prior review by that provider shall not be deemed in violation of this section unless first requested by the subscriber to remove age information.

(d) For purposes of this section, the following definitions apply:

(1) “Commercial online entertainment employment service provider” means a person or business that owns, licenses, or otherwise possesses computerized information, including, but not limited to, age and date of birth information, about individuals employed in the entertainment industry, including television, films, and video games, and that makes the information available to the public or potential employers.

(2) “Payment” means a fee in exchange for advertisements, or any other form of compensation or benefit.

(3) “Provide employment services” means post resumes, photographs, or other information about a subscriber when one of the purposes is to provide individually identifiable information about the subscriber to a prospective employer.

(4) “Subscriber” means a natural person who enters into a contractual agreement with a commercial online entertainment employment service provider to receive employment services in return for a subscription payment.

history: (History: Added by Stats. 2016, Ch. 555, Sec. 1. (AB 1687) Effective January 1, 2017.)

title: 1.81. CUSTOMER RECORDS

path: 1.81. CUSTOMER RECORDS


text:
(a) Any waiver of a provision of this title is contrary to public policy and is void and unenforceable.

(b) Any customer injured by a violation of this title may institute a civil action to recover damages.

(c) In addition, for a willful, intentional, or reckless violation of Section 1798.83, a customer may recover a civil penalty not to exceed three thousand dollars ($3,000) per violation; otherwise, the customer may recover a civil penalty of up to five hundred dollars ($500) per violation for a violation of Section 1798.83.

(d) Unless the violation is willful, intentional, or reckless, a business that is alleged to have not provided all the information required by subdivision (a) of Section 1798.83, to have provided inaccurate information, failed to provide any of the information required by subdivision (a) of Section 1798.83, or failed to provide information in the time period required by subdivision (b) of Section 1798.83, may assert as a complete defense in any action in law or equity that it thereafter provided regarding the information that was alleged to be untimely, all the information, or accurate information, to all customers who were provided incomplete or inaccurate information, respectively, within 90 days of the date the business knew that it had failed to provide the information, timely information, all the information, or the accurate information, respectively.

(e) Any business that violates, proposes to violate, or has violated this title may be enjoined.

(f) (1) A cause of action shall not lie against a business for disposing of abandoned records containing personal information by shredding, erasing, or otherwise modifying the personal information in the records to make it unreadable or undecipherable through any means.

(2) The Legislature finds and declares that when records containing personal information are abandoned by a business, they often end up in the possession of a storage company or commercial landlord. It is the intent of the Legislature in paragraph (1) to create a safe harbor for such a record custodian who properly disposes of the records in accordance with paragraph (1).

(g) A prevailing plaintiff in any action commenced under Section 1798.83 shall also be entitled to recover his or her reasonable attorney’s fees and costs.

(h) The rights and remedies available under this section are cumulative to each other and to any other rights and remedies available under law.

history: (History: Amended by Stats. 2009, Ch. 134, Sec. 3. (AB 1094) Effective January 1, 2010.)

title: 1.81. CUSTOMER RECORDS


text:
(a) No person, business, or association shall solicit, sell, or trade on the internet the home address or telephone number of an elected or appointed official with the intent to cause imminent great bodily harm to the official or to any person residing at the official’s home address.

(b) Notwithstanding any other law, an official whose home address or telephone number is solicited, sold, or traded in violation of subdivision (a) may bring an action in any court of competent jurisdiction.

(c) If a jury or court finds that a violation has occurred, it shall award damages to that official in an amount up to a maximum of three times the actual damages but in no case less than four thousand dollars ($4,000).

(d) “Elected or appointed official” has the same meaning as that term is defined in Section 7920.500 of the Government Code.

history: (History: Added by Stats. 2025, Ch. 200, Sec. 4. (AB 1521) Effective January 1, 2026.)

title: 1.81. CUSTOMER RECORDS


text:
(a) Except as provided in this section, a person or entity may not do any of the following:

(1) Publicly post or publicly display in any manner an individual’s social security number. “Publicly post” or “publicly display” means to intentionally communicate or otherwise make available to the general public.

(2) Print an individual’s social security number on any card required for the individual to access products or services provided by the person or entity.

(3) Require an individual to transmit the individual’s social security number over the internet, unless the connection is secure or the social security number is encrypted.

(4) Require an individual to use the individual’s social security number to access an internet website, unless a password or unique personal identification number or other authentication device is also required to access the internet website.

(5) Print an individual’s social security number on any materials that are mailed to the individual, unless state or federal law requires the social security number to be on the document to be mailed. Notwithstanding this paragraph, social security numbers may be included in applications and forms sent by mail, including documents sent as part of an application or enrollment process, or to establish, amend, or terminate an account, contract, or policy, or to confirm the accuracy of the social security number. A social security number that is permitted to be mailed under this section may not be printed, in whole or in part, on a postcard or other mailer not requiring an envelope, or visible on the envelope or without the envelope having been opened.

(6) Sell, advertise for sale, or offer to sell an individual’s social security number. For purposes of this paragraph, the following apply:

(A) “Sell” shall not include the release of an individual’s social security number if the release of the social security number is incidental to a larger transaction and is necessary to identify the individual in order to accomplish a legitimate business purpose. Release of an individual’s social security number for marketing purposes is not permitted.

(B) “Sell” shall not include the release of an individual’s social security number for a purpose specifically authorized or specifically allowed by federal or state law.

(b) This section does not prevent the collection, use, or release of a social security number as required by state or federal law or the use of a social security number for internal verification or administrative purposes.

(c) This section does not prevent an adult state correctional facility, an adult city jail, or an adult county jail from releasing an inmate’s social security number, with the inmate’s consent and upon request by the county veterans service officer or the United States Department of Veterans Affairs, for the purposes of determining the inmate’s status as a military veteran and the inmate’s eligibility for federal, state, or local veterans’ benefits or services.

(d) This section does not apply to documents that are recorded or required to be open to the public pursuant to Chapter 14 (commencing with Section 7150) or Chapter 14.5 (commencing with Section 7220) of Division 7 of Title 1 of, Division 10 (commencing with Section 7920.000) of Title 1 of, Article 9 (commencing with Section 11120) of Chapter 1 of Part 1 of Division 3 of Title 2 of, or Chapter 9 (commencing with Section 54950) of Part 1 of Division 2 of Title 5 of, the Government Code. This section does not apply to records that are required by statute, case law, or California Rules of Court, to be made available to the public by entities provided for in Article VI of the California Constitution.

(e) (1) In the case of a health care service plan, a provider of health care, an insurer or a pharmacy benefits manager, a contractor as defined in Section 56.05, or the provision by any person or entity of administrative or other services relative to health care or insurance products or services, including third-party administration or administrative services only, this section shall become operative in the following manner:

(A) On or before January 1, 2003, the entities listed in paragraph (1) shall comply with paragraphs (1), (3), (4), and (5) of subdivision (a) as these requirements pertain to individual policyholders or individual contractholders.

(B) On or before January 1, 2004, the entities listed in paragraph (1) shall comply with paragraphs (1) to (5), inclusive, of subdivision (a) as these requirements pertain to new individual policyholders or new individual contractholders and new groups, including new groups administered or issued on or after January 1, 2004.

(C) On or before July 1, 2004, the entities listed in paragraph (1) shall comply with paragraphs (1) to (5), inclusive, of subdivision (a) for all individual policyholders and individual contractholders, for all groups, and for all enrollees of the Healthy Families and Medi-Cal programs, except that for individual policyholders, individual contractholders and groups in existence prior to January 1, 2004, the entities listed in paragraph (1) shall comply upon the renewal date of the policy, contract, or group on or after July 1, 2004, but no later than July 1, 2005.

(2) A health care service plan, a provider of health care, an insurer or a pharmacy benefits manager, a contractor, or another person or entity as described in paragraph (1) shall make reasonable efforts to cooperate, through systems testing and other means, to ensure that the requirements of this article are implemented on or before the dates specified in this section.

(3) Notwithstanding paragraph (2), the Director of the Department of Managed Health Care, pursuant to the authority granted under Section 1346 of the Health and Safety Code, or the Insurance Commissioner, pursuant to the authority granted under Section 12921 of the Insurance Code, and upon a determination of good cause, may grant extensions not to exceed six months for compliance by health care service plans and insurers with the requirements of this section when requested by the health care service plan or insurer. Any extension granted shall apply to the health care service plan or insurer’s affected providers, pharmacy benefits manager, and contractors.

(f) If a federal law takes effect requiring the United States Department of Health and Human Services to establish a national unique patient health identifier program, a provider of health care, a health care service plan, a licensed health care professional, or a contractor, as those terms are defined in Section 56.05, that complies with the federal law shall be deemed in compliance with this section.

(g) A person or entity may not encode or embed a social security number in or on a card or document, including, but not limited to, using a barcode, chip, magnetic strip, or other technology, in place of removing the social security number, as required by this section.

(h) This section shall become operative, with respect to the University of California, in the following manner:

(1) On or before January 1, 2004, the University of California shall comply with paragraphs (1), (2), and (3) of subdivision (a).

(2) On or before January 1, 2005, the University of California shall comply with paragraphs (4) and (5) of subdivision (a).

(i) This section shall become operative with respect to the Franchise Tax Board on January 1, 2007.

(j) This section shall become operative with respect to the California community college districts on January 1, 2007.

(k) This section shall become operative with respect to the California State University system on July 1, 2005.

(l) This section shall become operative, with respect to the California Student Aid Commission and its auxiliary organization, in the following manner:

(1) On or before January 1, 2004, the commission and its auxiliary organization shall comply with paragraphs (1), (2), and (3) of subdivision (a).

(2) On or before January 1, 2005, the commission and its auxiliary organization shall comply with paragraphs (4) and (5) of subdivision (a).

history: (History: Amended by Stats. 2021, Ch. 615, Sec. 49. (AB 474) Effective January 1, 2022. Operative January 1, 2023, pursuant to Sec. 463 of Stats. 2021, Ch. 615.)

title: 1.81.1. CONFIDENTIALITY OF SOCIAL SECURITY NUMBERS


text: Any waiver of the provisions of this title is contrary to public policy, and is void and unenforceable.

history: (History: Added by Stats. 2002, Ch. 815, Sec. 16. Effective January 1, 2003.)

path: 1.81.1. CONFIDENTIALITY OF SOCIAL SECURITY NUMBERS


text:
(a) Unless otherwise required to do so by state or federal law, no person, entity, or governmental agency shall present for recording or filing with a county recorder a document that is required by any provision of law to be open to the public if that record displays more than the last four digits of a social security number. Unless otherwise authorized by state or federal law, a document containing more than the last four digits of a social security number is not entitled for recording.

(b) A recorder shall be deemed to be in compliance with the requirements of this section if he or she uses due diligence to truncate social security numbers in documents recorded, as provided in Article 3.5 (commencing with Section 27300) of Chapter 6 of Part 3 of Division 2 of Title 3 of the Government Code.

(c) This section shall not apply to documents created prior to January 1, 2010.

history: (History: Repealed and added by Stats. 2009, Ch. 552, Sec. 2. (SB 40) Effective January 1, 2010.)


text:
(a) This title shall be known and may be cited as the Reader Privacy Act.

(b) For purposes of this section:

(1) “Book” means paginated or similarly organized content in printed, audio, electronic, or other format, including fiction, nonfiction, academic, or other works of the type normally published in a volume or finite number of volumes, excluding serial publications such as a magazine or newspaper.

(2) “Book service” means a service that, as its primary purpose, provides the rental, purchase, borrowing, browsing, or viewing of books. “Book service” does not include a store that sells a variety of consumer products when the book service sales do not exceed 2 percent of the store’s total annual gross sales of consumer products sold in the United States.

(3) “Government entity” means any state or local agency, including, but not limited to, a law enforcement entity or any other investigative entity, agency, department, division, bureau, board, or commission, or any individual acting or purporting to act for or on behalf of a state or local agency.

(4) “Law enforcement entity” means a district attorney, a district attorney’s office, a municipal police department, a sheriff’s department, a county probation department, a county social services agency, the Department of Justice, the Department of Corrections and Rehabilitation, the Department of Corrections and Rehabilitation Division of Juvenile Facilities, the Department of the California Highway Patrol, the police department of a campus of a community college, the University of California, or the California State University, or any other department or agency of the state authorized to investigate or prosecute the commission of a crime.

(5) “Personal information” means all of the following:

(A) Any information that identifies, relates to, describes, or is associated with a particular user, including, but not limited to, the information specifically listed in Section 1798.80.

(B) A unique identifier or Internet Protocol address, when that identifier or address is used to identify, relate to, describe, or be associated with a particular user or book, in whole or in partial form.

(C) Any information that relates to, or is capable of being associated with, a particular user’s access to or use of a book service or a book, in whole or in partial form.

(6) “Provider” means any commercial entity offering a book service to the public.

(7) “User” means any person or entity that uses a book service.

(c) A provider shall not knowingly disclose to any government entity, or be compelled to disclose to any person, private entity, or government entity, any personal information of a user, except under any of the following circumstances:

(1) A provider shall disclose personal information of a user to a law enforcement entity only pursuant to a court order issued by a duly authorized court with jurisdiction over an offense that is under investigation and only if all of the following conditions are met:

(A) The court issuing the order finds that probable cause exists to believe the personal information requested is relevant evidence to the investigation of an offense and any of the grounds in Section 1524 of the Penal Code is satisfied.

(B) The court issuing the order finds that the law enforcement entity seeking disclosure has a compelling interest in obtaining the personal information sought.

(C) The court issuing the order finds that the personal information sought cannot be obtained by the law enforcement entity seeking disclosure through less intrusive means.

(D) Prior to issuance of the court order, the law enforcement entity seeking disclosure provides, in a timely manner, the provider with reasonable notice of the proceeding to allow the provider the opportunity to appear and contest issuance of the order.

(E) The law enforcement entity seeking disclosure has informed the provider that it has given notice of the court order to the user contemporaneously with the execution of the order, unless there is a judicial determination of a strong showing of necessity to delay that notification for a reasonable period of time, not to exceed 90 days.

(2) (A) A provider shall disclose personal information of a user to any of the following only if all of the conditions listed in subparagraph (B) are satisfied:

(i) A government entity, other than a law enforcement entity, pursuant to a court order issued by a court having jurisdiction over an offense under investigation by that government entity.

(ii) A government entity, other than a law enforcement entity, or a person or private entity pursuant to a court order in a pending action brought by the government entity or by the person or private entity.

(B) A provider shall disclose personal information of a user pursuant to subparagraph (A) only if all of the following conditions are satisfied:

(i) The court issuing the order finds that the person or entity seeking disclosure has a compelling interest in obtaining the personal information sought.

(ii) The court issuing the order finds that the personal information sought cannot be obtained by the person or entity seeking disclosure through less intrusive means.

(iii) Prior to issuance of the court order, the person or entity seeking disclosure provides, in a timely manner, the provider with reasonable notice of the proceeding to allow the provider the opportunity to appear and contest the issuance of the court order.

(iv) The provider refrains from disclosing any personal information pursuant to the court order until it provides, in a timely manner, notice to the user about the issuance of the order and the ability to appear and quash the order, and the user has been given a minimum of 35 days prior to disclosure of the information within which to appear and quash the order.

(3) A provider shall disclose the personal information of a user to any person, private entity, or government entity if the user has given his or her informed, affirmative consent to the specific disclosure for a particular purpose.

(4) A provider may disclose personal information of a user to a government entity, if the government entity asserts, and the provider in good faith believes, that there is an imminent danger of death or serious physical injury requiring the immediate disclosure of the requested personal information and there is insufficient time to obtain a court order. The government entity seeking the disclosure shall provide the provider with a written statement setting forth the facts giving rise to the emergency upon request or no later than 48 hours after seeking disclosure.

(5) A provider may disclose personal information of a user to a government entity if the provider in good faith believes that the personal information is evidence directly related and relevant to a crime against the provider or that user.

(d) (1) Any court issuing a court order requiring the disclosure of personal information of a user shall impose appropriate safeguards against the unauthorized disclosure of personal information by the provider and by the person, private entity, or government entity seeking disclosure pursuant to the order.

(2) The court may, in its discretion, quash or modify a court order requiring the disclosure of the user’s personal information upon a motion made by the user, provider, person, or entity seeking disclosure.

(e) A provider, upon the request of a law enforcement entity, shall take all necessary steps to preserve records and other evidence in its possession of a user’s personal information related to the use of a book or part of a book, pending the issuance of a court order or a warrant pursuant to this section or Section 1798.90.05. The provider shall retain the records and evidence for a period of 90 days from the date of the request by the law enforcement entity, which shall be extended for an additional 90-day period upon a renewed request by the law enforcement entity.

(f) Except in an action for a violation of this section, no evidence obtained in violation of this section shall be admissible in any civil or administrative proceeding.

(g) (1) Violations of this section shall be subject to the following penalties:

(A) Any provider that knowingly provides personal information about a user to a government entity in violation of this section shall be subject to a civil penalty not to exceed five hundred dollars ($500) for each violation, which shall be paid to the user in a civil action brought by the user.

(B) Any provider that knowingly provides personal information about a user to a government entity in violation of this section shall, in addition to the penalty prescribed by subparagraph (A), be subject to a civil penalty not to exceed five hundred dollars ($500) for each violation, which may be assessed and recovered in a civil action brought by the Attorney General, by any district attorney or city attorney, or by a city prosecutor in any city having a full-time city prosecutor, in any court of competent jurisdiction.

(2) If an action is brought by the Attorney General, one-half of the penalty collected shall be paid to the treasurer of the county in which the judgment was entered, and one-half to the General Fund. If the action is brought by a district attorney, the penalty collected shall be paid to the treasurer of the county in which the judgment was entered. If the action is brought by a city attorney or city prosecutor, one-half of the penalty shall be paid to the treasurer of the city in which the judgment was entered, and one-half to the treasurer of the county in which the judgment was entered.

(3) The penalties provided by this section are not the exclusive remedy and do not affect any other relief or remedy provided by law.

(4) A civil action brought pursuant to this section shall be commenced within two years after the date upon which the claimant first discovered the violation.

(h) An objectively reasonable reliance by the provider on a warrant or court order for the disclosure of personal information of a user, or on any of the enumerated exceptions to the confidentiality of a user’s personal information set forth in this section, is a complete defense to any civil action for the violation of this section.

(i) (1) Unless disclosure of information pertaining to a particular request or set of requests is specifically prohibited by law, a provider shall prepare a report including all of the following information, to the extent it can be reasonably determined:

(A) The number of federal and state warrants, federal and state grand jury subpoenas, federal and state civil and administrative subpoenas, federal and state civil and criminal court orders, and requests for information made with the informed consent of the user as described in paragraph (3) of subdivision (c), seeking disclosure of any personal information of a user related to the access or use of a book service or book, received by the provider from January 1 to December 31, inclusive, of the previous year.

(B) The number of disclosures made by the provider pursuant to paragraphs (4) and (5) of subdivision (c) from January 1 to December 31, inclusive, of the previous year.

(C) For each category of demand or disclosure, the provider shall include all of the following information:

(i) The number of times notice of a court order in a criminal, civil, or administrative action has been provided by the provider and the date the notice was provided.

(ii) The number of times personal information has been disclosed by the provider.

(iii) The number of times no personal information has been disclosed by the provider.

(iv) The number of times the provider contests the demand.

(v) The number of times the user contests the demand.

(vi) The number of users whose personal information was disclosed by the provider.

(vii) The type of personal information that was disclosed and the number of times that type of personal information was disclosed.

(2) Notwithstanding paragraph (1), a provider is not required to prepare a report pursuant to this subdivision unless it has disclosed personal information related to the access or use of a book service or book of more than 30 total users consisting of users located in this state or users whose location is unknown or of both types of users.

(3) The reporting requirements of this subdivision shall not apply to information disclosed to a government entity that is made by a provider serving a postsecondary educational institution when the provider is required to disclose the information in order to be reimbursed for the sale or rental of a book that was purchased or rented by a student using book vouchers or other financial aid subsidies for books.

(j) Reports prepared pursuant to subdivision (i) shall be made publicly available in an online, searchable format on or before March 1 of each year. If the provider does not have an Internet Web site, the provider shall post the reports prominently on its premises or send the reports to the Office of Privacy Protection on or before March 1 of each year.

(k) On or before March 1 of each year, a provider subject to Section 22575 of the Business and Professions Code shall complete one of the following actions:

(1) Create a prominent hyperlink to its latest report prepared pursuant to subdivision (i) in the disclosure section of its privacy policy applicable to its book service.

(2) Post the report prepared pursuant to subdivision (i) in the section of its Internet Web site explaining the way in which user information and privacy issues related to its book service are addressed.

(3) State on its Internet Web site in one of the areas described in paragraphs (1) and (2) that no report prepared pursuant to subdivision (i) is available because the provider is exempt from the reporting requirement pursuant to paragraph (2) of subdivision (i).

(l) Nothing in this section shall otherwise affect the rights of any person under the California Constitution or any other law or be construed as conflicting with the federal Privacy Protection Act of 1980 (42 U.S.C. 2000aa et seq.).

history: (History: Added by Stats. 2011, Ch. 424, Sec. 1. (SB 602) Effective January 1, 2012.)

title: 1.81.15. Reader Privacy Act

path: 1.81.15. Reader Privacy Act


text:
(a) (1) A business may scan or swipe a driver’s license or identification card issued by the Department of Motor Vehicles in any electronic device for the following purposes:

(A) To verify age or the authenticity of the driver’s license or identification card.

(B) To comply with a legal requirement to record, retain, or transmit that information.

(C) To transmit information to a check service company for the purpose of approving negotiable instruments, electronic funds transfers, or similar methods of payments, provided that only the name and identification number from the license or the card may be used or retained by the check service company.

(D) To collect or disclose personal information that is required for reporting, investigating, or preventing fraud, abuse, or material misrepresentation.

(2) (A) An organ procurement organization may scan or swipe a driver’s license or identification card issued by the Department of Motor Vehicles in any electronic device to transmit information to the Donate Life California Organ and Tissue Donor Registry established pursuant to Section 7150.90 of the Health and Safety Code for the purposes of allowing an individual to identify himself or herself as a registered organ donor. Information gathered or transmitted pursuant to this paragraph shall comply with the Department of Motor Vehicles Information Security Agreement.

(B) Prior to scanning or swiping a driver’s license or identification card issued by the Department of Motor Vehicles, an organ procurement organization shall provide clear and conspicuous notice to the applicant and shall follow the procedure prescribed in this subparagraph:

(i) Once the applicant’s information is populated on the electronic form, the applicant shall verify that the information is accurate and shall click “submit” after reading a clear and conspicuous consent message, which shall not be combined with or contained within another message, acknowledging that the applicant’s information will be used for the sole purpose of being added to the registry.

(ii) The applicant shall provide his or her signature to complete registration.

(iii) The organization or registry system shall provide a written confirmation to the applicant confirming that he or she is signed up as an organ and tissue donor.

(3) A business or organ procurement organization shall not retain or use any of the information obtained by that electronic means for any purpose other than as provided herein.

(b) As used in this section:

(1) “Business” means a proprietorship, partnership, corporation, or any other form of commercial enterprise.

(2) “Organ procurement organization” means a person designated by the Secretary of the federal Department of Health and Human Services as an organ procurement organization.

(c) A violation of this section constitutes a misdemeanor punishable by imprisonment in a county jail for no more than one year, or by a fine of no more than ten thousand dollars ($10,000), or by both.

history: (History: Amended by Stats. 2018, Ch. 548, Sec. 1. (AB 2769) Effective January 1, 2019.)

title: 1.81.2. CONFIDENTIALITY OF DRIVER'S LICENSE INFORMATION


text: Section 1798.90 does not make it unlawful for a law enforcement entity subject to Section 2000aa of Title 42 of the United States Code to obtain a search warrant for the personal information of a user pursuant to otherwise applicable law in connection with the investigation or prosecution of a criminal offense when probable cause exists to believe that the person possessing the personal information has committed, or is committing, a criminal offense involving the production, possession, receipt, mailing, sale, distribution, shipment, or transportation of child pornography, the sexual exploitation of children, or the sale or purchase of children prohibited by Sections 2251, 2251A, 2252, and 2252A of Title 18 of the United States Code. Nothing in Section 1798.90 shall prevent a provider from complying with a proper search warrant issued by a duly authorized court in connection with the investigation or prosecution of any of those offenses.

title: 1.81.15. Reader Privacy Act


text:
The following definitions shall apply for purposes of this title:

(a) “Automated license plate recognition end-user” or “ALPR end-user” means a person that accesses or uses an ALPR system, but does not include any of the following:

(1) A transportation agency when subject to Section 31490 of the Streets and Highways Code.

(2) A person that is subject to Sections 6801 to 6809, inclusive, of Title 15 of the United States Code and state or federal statutes or regulations implementing those sections, if the person is subject to compliance oversight by a state or federal regulatory agency with respect to those sections.

(3) A person, other than a law enforcement agency, to whom information may be disclosed as a permissible use pursuant to Section 2721 of Title 18 of the United States Code.

(b) “Automated license plate recognition information,” or “ALPR information” means information or data collected through the use of an ALPR system.

(c) “Automated license plate recognition operator” or “ALPR operator” means a person that operates an ALPR system, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.

(d) “Automated license plate recognition system” or “ALPR system” means a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.

(e) “Person” means any natural person, public agency, partnership, firm, association, corporation, limited liability company, or other legal entity.

(f) “Public agency” means the state, any city, county, or city and county, or any agency or political subdivision of the state or a city, county, or city and county, including, but not limited to, a law enforcement agency.

history: (History: Added by Stats. 2015, Ch. 532, Sec. 3. (SB 34) Effective January 1, 2016.)

title: 1.81.23. COLLECTION OF LICENSE PLATE INFORMATION


text:
An ALPR operator shall do all of the following:

(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.

(b) (1) Implement a usage and privacy policy in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR operator has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.

(2) The usage and privacy policy shall, at a minimum, include all of the following:

(A) The authorized purposes for using the ALPR system and collecting ALPR information.

(B) A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.

(C) A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws.

(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.

(E) The title of the official custodian, or owner, of the ALPR system responsible for implementing this section.

(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.

(G) The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.

path: 1.81.23. COLLECTION OF LICENSE PLATE INFORMATION


text:
If an ALPR operator accesses or provides access to ALPR information, the ALPR operator shall do both of the following:

(a) Maintain a record of that access. At a minimum, the record shall include all of the following:

(1) The date and time the information is accessed.

(2) The license plate number or other data elements used to query the ALPR system.

(3) The username of the person who accesses the information, and, as applicable, the organization or entity with whom the person is affiliated.

(4) The purpose for accessing the information.

(b) Require that ALPR information only be used for the authorized purposes described in the usage and privacy policy required by subdivision (b) of Section 1798.90.51.


text:
An ALPR end-user shall do all of the following:

(a) Maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.

(b) (1) Implement a usage and privacy policy in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties. The usage and privacy policy shall be available to the public in writing, and, if the ALPR end-user has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.

(2) The usage and privacy policy shall, at a minimum, include all of the following:

(A) The authorized purposes for accessing and using ALPR information.

(B) A description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors.

(C) A description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws and a process for periodic system audits.

(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons.

(E) The title of the official custodian, or owner, of the ALPR information responsible for implementing this section.

(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors.

(G) The length of time ALPR information will be retained, and the process the ALPR end-user will utilize to determine if and when to destroy retained ALPR information.


text:
(a) In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.

(b) The court may award a combination of any one or more of the following:

(1) Actual damages, but not less than liquidated damages in the amount of two thousand five hundred dollars ($2,500).

(2) Punitive damages upon proof of willful or reckless disregard of the law.

(3) Reasonable attorney’s fees and other litigation costs reasonably incurred.

(4) Other preliminary and equitable relief as the court determines to be appropriate.


text:
Notwithstanding any other law or regulation:

(a) A public agency that operates or intends to operate an ALPR system shall provide an opportunity for public comment at a regularly scheduled public meeting of the governing body of the public agency before implementing the program.

(b) A public agency shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law. For purposes of this section, the provision of data hosting or towing services shall not be considered the sale, sharing, or transferring of ALPR information.


text:
(a) For purposes of this title, the following definitions shall apply:

(1) “Direct marketing purposes” means the use of personal information for marketing or advertising products, goods, or services directly to individuals. “Direct marketing purposes” does not include the use of personal information (A) by bona fide tax exempt charitable or religious organizations to solicit charitable contributions or (B) to raise funds from and communicate with individuals regarding politics and government.

(2) “Medical information” means any individually identifiable information, in electronic or physical form, regarding the individual’s medical history, or medical treatment or diagnosis by a health care professional. “Individually identifiable” means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the individual’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity. For purposes of this section, “medical information” does not mean a subscription to, purchase of, or request for a periodical, book, pamphlet, video, audio, or other multimedia product or nonprofit association information.

(3) “Clear and conspicuous” means in larger type than the surrounding text, or in contrasting type, font, or color to the surrounding text of the same size, or set off from the surrounding text of the same size by symbols or other marks that call attention to the language.

(4) For purposes of this section, the collection of medical information online constitutes “in writing.” For purposes of this section, “written consent” includes consent obtained online.

(b) A business may not orally request medical information directly from an individual regardless of whether the information pertains to the individual or not, and use, share, or otherwise disclose that information for direct marketing purposes, without doing both of the following prior to obtaining that information:

(1) Orally disclosing to the individual in the same conversation during which the business seeks to obtain the information, that it is obtaining the information to market or advertise products, goods, or services to the individual.

(2) Obtaining the consent of either the individual to whom the information pertains or a person legally authorized to consent for the individual, to permit his or her medical information to be used or shared to market or advertise products, goods, or services to the individual, and making and maintaining for two years after the date of the conversation, an audio recording of the entire conversation.

(c) A business may not request in writing medical information directly from an individual regardless of whether the information pertains to the individual or not, and use, share, or otherwise disclose that information for direct marketing purposes, without doing both of the following prior to obtaining that information:

(1) Disclosing in a clear and conspicuous manner that it is obtaining the information to market or advertise products, goods, or services to the individual.

(2) Obtaining the written consent of either the individual to whom the information pertains or a person legally authorized to consent for the individual, to permit his or her medical information to be used or shared to market or advertise products, goods, or services to the individual.

(d) This section does not apply to a provider of health care, health care service plan, or contractor, as defined in Section 56.05.

(e) This section shall not apply to an insurance institution, agent, or support organization, as defined in Section 791.02 of the Insurance Code, when engaged in an insurance transaction, as defined in Section 791.02 of the Insurance Code, pursuant to all the requirements of Article 6.6 (commencing with Section 791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code, and the regulations promulgated thereunder.

(f) This section does not apply to a telephone corporation, as defined in Section 234 of the Public Utilities Code, when that corporation is engaged in providing telephone services and products pursuant to Sections 2881, 2881.1, and 2881.2 of the Public Utilities Code, if the corporation does not share or disclose medical information obtained as a consequence of complying with those sections of the Public Utilities Code, to third parties for direct marketing purposes.

history: (History: Amended by Stats. 2013, Ch. 444, Sec. 7. (SB 138) Effective January 1, 2014.)

title: 1.81.25. CONSUMER PRIVACY PROTECTION

path: 1.81.25. CONSUMER PRIVACY PROTECTION


text:
(a) For the purposes of this section, the following definitions shall apply:

(1) “Booking photograph” means a photograph of a subject individual taken pursuant to an arrest or other involvement in the criminal justice system.

(2) “Subject individual” means an individual who was arrested.

(3) “Person” means a natural person, partnership, joint venture, corporation, limited liability company, or other entity.

(4) “Public entity” means the state, county, city, special district, or other political subdivision therein.

(b) It shall be unlawful practice for any person engaged in publishing or otherwise disseminating a booking photograph through a print or electronic medium to solicit, require, or accept the payment of a fee or other consideration from a subject individual to remove, correct, modify, or to refrain from publishing or otherwise disseminating that booking photograph.

(c) Notwithstanding subdivision (b), a public entity may require and accept a reasonable administrative fee to correct a booking photograph.

(d) Each payment solicited or accepted in violation of these provisions constitutes a separate violation.

(e) In addition to any other sanctions, penalties, or remedies provided by law, a subject individual may bring a civil action in any court of competent jurisdiction against any person in violation of this section for damages in an amount equal to the greater of one thousand dollars ($1,000) per violation or the actual damages suffered by him or her as a result, along with costs, reasonable attorney’s fees, and any other legal or equitable relief.

(f) The jurisdiction of a civil action brought pursuant to subdivision (e) shall also include the county in which the subject individual resides at the time of the violation of this section.

history: (History: Added by Stats. 2014, Ch. 194, Sec. 1. (SB 1027) Effective January 1, 2015.)

title: 1.81.27. Commercial Use of Booking Photographs


text:
(a) A manufacturer of a connected device shall equip the device with a reasonable security feature or features that are all of the following:

(1) Appropriate to the nature and function of the device.

(2) Appropriate to the information it may collect, contain, or transmit.

(3) Designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure.

(b) Subject to all of the requirements of subdivision (a), if a connected device is equipped with a means for authentication outside a local area network, it shall be deemed a reasonable security feature under subdivision (a) if either of the following requirements are met:

(1) The preprogrammed password is unique to each device manufactured.

(2) The device contains a security feature that requires a user to generate a new means of authentication before access is granted to the device for the first time.

(c) A manufacturer of a connected device may elect to satisfy the requirements of subdivision (a) by ensuring the connected device does all of the following:

(1) Meets or exceeds the baseline product criteria of a NIST conforming labeling scheme.

(2) Satisfies a conformity assessment as described by a NIST conforming labeling scheme that includes a third-party test, inspection, or certification.

(3) Bears the binary label as described by a NIST conforming labeling scheme.

history: (History: Amended (as added by Stats. 2018, Ch. 860, Sec. 1) by Stats. 2022, Ch. 785, Sec. 2. (AB 2392) Effective January 1, 2023. See similar section in the Title 1.81.26 added by Stats. 2018, Ch. 886.)

title: 1.81.26. Security of Connected Devices

path: 1.81.26. Security of Connected Devices


text:
For the purposes of this title, the following terms have the following meanings:

(a) “Authentication” means a method of verifying the authority of a user, process, or device to access resources in an information system.

(b) “Connected device” means any device, or other physical object that is capable of connecting to the internet, directly or indirectly, and that is assigned an internet protocol address or Bluetooth address.

(c) “Manufacturer” means the person who manufactures, or contracts with another person to manufacture on the person’s behalf, connected devices that are sold or offered for sale in California. For the purposes of this subdivision, a contract with another person to manufacture on the person’s behalf does not include a contract only to purchase a connected device, or only to purchase and brand a connected device.

(d) “NIST conforming labeling scheme” means a labeling scheme conforming to the Cybersecurity White Paper titled “Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products” published by the National Institute of Standards and Technology (NIST) on February 4, 2022, including any revisions or successor publications.

(e) “Security feature” means a feature of a device designed to provide security for that device.

(f) “Unauthorized access, destruction, use, modification, or disclosure” means access, destruction, use, modification, or disclosure that is not authorized by the consumer.

history: (History: Amended (as added by Stats. 2018, Ch. 860, Sec. 1) by Stats. 2022, Ch. 785, Sec. 3. (AB 2392) Effective January 1, 2023. See similar section in the Title 1.81.26 added by Stats. 2018, Ch. 886.)

title: 1.81.26. Security of Connected Devices


text:
(a) This title shall not be construed to impose any duty upon the manufacturer of a connected device related to unaffiliated third-party software or applications that a user chooses to add to a connected device.

(b) This title shall not be construed to impose any duty upon a provider of an electronic store, gateway, marketplace, or other means of purchasing or downloading software or applications, to review or enforce compliance with this title.

(c) This title shall not be construed to impose any duty upon the manufacturer of a connected device to prevent a user from having full control over a connected device, including the ability to modify the software or firmware running on the device at the user’s discretion.

(d) This title shall not apply to any connected device the functionality of which is subject to security requirements under federal law, regulations, or guidance promulgated by a federal agency pursuant to its regulatory enforcement authority.

(e) This title shall not be construed to provide a basis for a private right of action. The Attorney General, a city attorney, a county counsel, or a district attorney shall have the exclusive authority to enforce this title.

(f) The duties and obligations imposed by this title are cumulative with any other duties or obligations imposed under other law, and shall not be construed to relieve any party from any duties or obligations imposed under other law.

(g) This title shall not be construed to limit the authority of a law enforcement agency to obtain connected device information from a manufacturer as authorized by law or pursuant to an order of a court of competent jurisdiction.

(h) A covered entity, provider of health care, business associate, health care service plan, contractor, employer, or any other person subject to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191) or the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) shall not be subject to this title with respect to any activity regulated by those acts.

(i) This title shall become operative on January 1, 2020.

history: (History: Added by Stats. 2018, Ch. 860, Sec. 1. (AB 1906) Effective January 1, 2019. Operative January 1, 2020, by its own provisions. See similar section in the Title 1.81.26 added by Stats. 2018, Ch. 886.)

title: 1.81.26. Security of Connected Devices


text:
For the purposes of this title:

(a) “Claimant” means a person who has or purports to have a claim for money or an interest in property in connection with a transaction procured through identity theft.

(b) “Identity theft” means the unauthorized use of another person’s personal identifying information to obtain credit, goods, services, money, or property.

(c) “Personal identifying information” means a person’s name, address, telephone number, driver’s license number, social security number, place of employment, employee identification number, mother’s maiden name, demand deposit account number, savings account number, or credit card number.

(d) “Victim of identity theft” means a person who had their personal identifying information used without authorization by another to obtain credit, goods, services, money, or property, and did not use or possess the credit, goods, services, money, or property obtained by the identity theft, and has submitted a Federal Trade Commission identity theft report. In the alternative, the person may have filed a police report in this regard pursuant to Section 530.5 of the Penal Code.

history: (History: Amended by Stats. 2021, Ch. 265, Sec. 3. (AB 430) Effective January 1, 2022.)

title: 1.81.3. IDENTITY THEFT

path: 1.81.3. IDENTITY THEFT


text:
(a) A person may bring an action against a claimant to establish that the person is a victim of identity theft in connection with the claimant’s claim against that person. If the claimant has brought an action to recover on its claim against the person, the person may file a cross-complaint to establish that the person is a victim of identity theft in connection with the claimant’s claim.

(b) A person shall establish that they are a victim of identity theft by a preponderance of the evidence.

(c) A person who proves that they are a victim of identity theft, as defined in Section 530.5 of the Penal Code, as to a particular claim, shall be entitled to a judgment providing all of the following, as appropriate:

(1) A declaration that they are not obligated to the claimant on that claim.

(2) A declaration that any security interest or other interest the claimant had purportedly obtained in the victim’s property in connection with that claim is void and unenforceable.

(3) An injunction restraining the claimant from collecting or attempting to collect from the victim on that claim, from enforcing or attempting to enforce any security interest or other interest in the victim’s property in connection with that claim, or from enforcing or executing on any judgment against the victim on that claim.

(4) If the victim has filed a cross-complaint against the claimant, the dismissal of any cause of action in the complaint filed by the claimant based on a claim which arose as a result of the identity theft.

(5) Actual damages, attorney’s fees, and costs, and any equitable relief that the court deems appropriate. In order to recover actual damages or attorney’s fees in an action or cross-complaint filed by a person alleging that they are a victim of identity theft, the person shall show that they provided written notice to the claimant that a situation of identity theft might exist, including, upon written request of the claimant, a valid, signed Federal Trade Commission (FTC) identity theft report completed at least 30 days before filing the action, or within their cross-complaint pursuant to this section. In the alternative, the person may provide a valid copy of a police report or of a Department of Motor Vehicles (DMV) investigative report, filed pursuant to Section 530.5 of the Penal Code, at least 30 days before filing the action or within their cross-complaint pursuant to this section. For the purposes of this paragraph, if the person submits an FTC identity theft report, the claimant shall not also require a DMV or police report.

(6) A civil penalty, in addition to any other damages, of up to thirty thousand dollars ($30,000) if the victim establishes by clear and convincing evidence all of the following:

(A) That at least 30 days prior to filing an action or within the cross-complaint pursuant to this section, they provided written notice to the claimant at the address designated by the claimant for complaints related to credit reporting issues that a situation of identity theft might exist and explaining the basis for that belief.

(B) That the claimant failed to diligently investigate the victim’s notification of a possible identity theft.

(C) That the claimant continued to pursue its claim against the victim after the claimant was presented with facts that were later held to entitle the victim to a judgment pursuant to this section.

history: (History: Amended by Stats. 2021, Ch. 265, Sec. 4. (AB 430) Effective January 1, 2022.)

title: 1.81.3. IDENTITY THEFT


text: An action or cross-complaint brought under this title that joins other claimants as defendants in the same action or cross-complaint shall be deemed to comply with Section 379 of the Code of Civil Procedure.

history: (History: Added by Stats. 2001, Ch. 354, Sec. 21. Effective January 1, 2002.)

title: 1.81.3. IDENTITY THEFT


text: A court shall have continuing jurisdiction over an action or cross-complaint filed pursuant to this title in order to provide for the joinder of related causes of action based on the theft of the same person’s identity and the joinder of further defendants based upon the theft of the same person’s identity, regardless of whether a final judgment has been entered as to any defendant. The court’s continuing jurisdiction shall terminate 10 years after filing of the original action unless the court, prior to that date, finds good cause to extend jurisdiction over the matter.

title: 1.81.3. IDENTITY THEFT


text: Any action brought pursuant to this title or any joinder of a defendant pursuant to Section 1798.82 may be brought within four years of the date the person who alleges that he or she is a victim of identity theft knew or, in the exercise of reasonable diligence, should have known of the existence of facts which would give rise to the bringing of the action or joinder of the defendant.

title: 1.81.3. IDENTITY THEFT


text:
(a) This title does not apply to a transaction subject to Section 1747.10.

(b) Nothing is this title shall be construed to affect a claimant’s rights and remedies against a person who perpetrates identity theft or against any person who used or possessed the credit, goods, services, or property obtained by identity theft.

(c) This title is cumulative to the rights and remedies provided under other laws.

title: 1.81.3. IDENTITY THEFT


text:
For purposes of this title, the following definitions apply:

(a) “Adequate documentation” means documentation that identifies a particular debt, or portion thereof, as coerced debt, describes the circumstances under which the coerced debt was incurred, and takes the form of any of the following:

(1) A police report.

(2) A Federal Trade Commission identity theft report identifying a particular debt, or portion thereof, as coerced, but not as identity theft.

(3) A court order issued pursuant to Section 6340 of the Family Code relating to domestic violence, Section 213.5 of the Welfare and Institutions Code relating to a dependent or ward of the juvenile court, or Section 15657.03 of the Welfare and Institutions Code relating to elder or dependent adult abuse.

(4) (A) A sworn written certification from a qualified third-party professional based on information they received while acting in a professional capacity.

(B) The documentation described by subparagraph (A) shall be signed by a qualified third-party professional and display the letterhead, address, and telephone number of the office, institution, center, or organization, as appropriate, that engages or employs, whether financially compensated or not, the qualified third-party professional, or, if the qualified third-party professional is self-employed, the documentation shall display the letterhead, address, and telephone number of the qualified third-party professional.

(b) “Claim” means a right to payment, whether or not that right is reduced to judgment, liquidated, unliquidated, fixed, contingent, matured, unmatured, disputed, undisputed, legal, or equitable.

(c) (1) “Claimant” means a person or an entity who has or purports to have a claim against a debtor arising from coerced debt, or that person’s or entity’s successor or assignee. “Claimant” includes, but is not limited to, a debt collector or a debt buyer.

(2) Notwithstanding paragraph (1), “claimant” shall not include a person who caused the claim described in paragraph (1) to arise through duress, intimidation, threat of force, force, fraud, or undue influence perpetrated against the debtor.

(d) “Coerced debt” means a particular debt, or portion thereof, for personal, family, or household use in the name of a debtor who is a victim of domestic violence, or a victim of elder or dependent adult abuse, or a person who is a foster youth, incurred as a result of duress, intimidation, threat of force, force, fraud, or undue influence.

(1) For purposes of this subdivision, “domestic violence” has the same meaning as in Section 6211 of the Family Code.

(2) For the purposes of this subdivision, “foster youth” has the same meaning as in Section 42238.01 of the Education Code.

(3) For the purposes of this subdivision, “dependent adult” has the same meaning as in Section 15610.23 of the Welfare and Institutions Code.

(4) For the purposes of this subdivision, “elder” has the same meaning as in Section 15610.27 of the Welfare and Institutions Code.

(e) “Debtor” means a person who owes or is otherwise liable for coerced debt.

(f) “Fraud” means an initial fraudulent act that is perpetrated against the debtor.

(g) “Immediate family member” has the same meaning as defined in paragraph (3) of subdivision (h) of Section 1946.7.

(h) “Person” means a natural person.

(i) “Qualified third-party professional” means any of the following:

(1) A domestic violence counselor, as defined in Section 1037.1 of the Evidence Code.

(2) A sexual assault counselor, as defined in Section 1035.2 of the Evidence Code.

(3) A Court-Appointed Special Advocate, as defined in Section 101 of the Welfare and Institutions Code.

(4) A court-appointed attorney, as defined in subdivision (e) of Section 317 of the Welfare and Institutions Code.

(5) A board certified psychiatrist or psychologist.

(6) A licensed marriage and family therapist.

(7) A licensed professional clinical counselor.

(8) A licensed clinical social worker.

(9) A social worker or caseworker employed by an adult protective service agency for the purposes described in Chapter 13 (commencing with Section 15750) of Part 3 of Division 9 of the Welfare and Institutions Code.

(10) A social worker who has completed the child welfare training program described in Article 2 (commencing with Section 16205) of Chapter 3 of Part 4 of Division 9 of the Welfare and Institutions Code.

(j) (1) “Sworn written certification” means a document in which the author declares under penalty of perjury as true any material fact, and which is accompanied by the following, to the extent that an item listed below is relevant to the debtor’s allegation that the debt is coerced debt:

(A) A copy of the debtor’s driver’s license or identification card, as issued by the state.

(B) Any other identification document that supports the statement that the particular debt, or portion thereof, is coerced debt.

(C) An express statement that the debtor did not willingly authorize the use of the debtor’s name or personal information for incurring the coerced debt, and specific facts supporting the claim of coerced debt, if available, and, if not all of the debt was coerced, a statement identifying the portion thereof that was coerced.

(D) Any available correspondence disputing the coerced debt after transaction information has been provided to the debtor.

(E) Information, if known by the debtor, including, but not limited to, a credit card number or loan number, that can be used by the claimant to identify the account associated with the coerced debt and the person or persons in whose name the debt was incurred.

(F) The identity of the person or persons who coerced the debtor into incurring the debt and contact information for that person or persons, if known by the debtor, unless the debtor signs a sworn statement that disclosing this information is likely to result in abuse, as defined in Section 6203 of the Family Code, to the debtor or an immediate family member of the debtor.

(G) A telephone number for contacting the person signing the certification concerning any additional information or questions, or direction that further communications to the debtor be in writing only, with the mailing address specified in the statement.

(2) The certification required by this subdivision shall be sufficient if it is in substantially the following form:

“I declare under penalty of perjury that the representations made herein are true, correct, and contain no material omissions of fact.

_______(Date and Place)________ _______(Signature)________”

history: (History: Added by Stats. 2022, Ch. 989, Sec. 2. (SB 975) Effective January 1, 2023.)

title: 1.81.35. Coerced Debt

path: 1.81.35. Coerced Debt


text:
(a) A person shall not cause another person to incur a coerced debt. A person who causes another person to incur a coerced debt in violation of this subdivision shall be civilly liable to the claimant for the amount of the debt, or portion thereof, determined by a court to be coerced debt, plus the claimant’s attorney’s fees and costs.

(b) Upon receipt of both of the following, a claimant shall cease collection activities until completion of the review provided in subdivision (d):

(1) Adequate documentation.

(2) The debtor’s sworn written certification that a particular debt, or portion thereof, being collected is coerced debt.

(c) If a debtor notifies a claimant orally that a particular debt, or portion thereof, being collected is coerced debt, the claimant shall notify the debtor, orally or in writing, that the debtor’s notification must be in writing. If a debtor notifies a claimant in writing that a particular debt, or portion thereof, being collected is coerced debt, but omits information required by subdivision (b), and if the claimant does not cease collection activities, the claimant shall provide written notice to the debtor of the additional information that is required.

(d) (1) Within 10 business days of receiving the complete statement and information described in subdivision (b), the claimant shall, if the claimant furnished adverse information about the debtor to a consumer credit reporting agency, notify the consumer credit reporting agency that the account is disputed.

(2) The claimant shall initiate a review considering all of the information provided by the debtor and other information available to the claimant in its file.

(3) Within 10 business days of completing the review, the claimant shall notify the debtor in writing of the claimant’s determination and the good faith basis for that determination.

(4) The claimant shall not recommence collection activities until the debtor has been notified in writing of the good faith determination that the information does not establish that the particular debt, or portion thereof, is coerced debt.

(e) No inference or presumption that the debt is valid or invalid, or that the debtor is liable or not liable for the particular debt, or portion thereof, shall arise if the claimant decides after the review described in subdivision (d) to cease or recommence collection activities. The exercise or nonexercise of rights under this section is not a waiver of any other right or defense of the debtor or claimant.

(f) (1) At least 30 days before filing an action pursuant to paragraph (2) of subdivision (a) of Section 1798.97.3 or other action against a claimant in connection with an allegedly coerced debt, a debtor shall submit notice of the debtor’s intent to file an action against the claimant and documents that comply with subdivision (b) in writing to the claimant.

(2) The written notice described in paragraph (1) shall be sent by certified mail, overnight delivery, or other method that allows for confirmation of the delivery date.

(3) The written notice described in paragraph (1) shall be sent to an address made available to the debtor by the claimant for receipt of the notice, or, if an address has not been identified by the claimant, to the claimant’s principal place of business as identified by the Secretary of State. If an address is unavailable through the Secretary of State’s website, the debtor may use the correspondence address of the claimant, or in the case of a debt collector, the address on file with the Department of Financial Protection and Innovation for licensing purposes.

(4) (A) The debtor shall not commence an action described in subdivision (a) of Section 1798.97.3 or other action against a claimant in connection with an allegedly coerced debt if the claimant informs the debtor that it has ceased all efforts to collect on the particular debt, or portion thereof, identified in the written notice pursuant to paragraph (1) and the debtor receives written notice of this cessation before the expiration of the 30-day period.

(B) The debtor may commence an action described in subdivision (a) of Section 1798.97.3 or other action against a claimant in connection with an allegedly coerced debt if either of the following conditions is satisfied:

(i) The 30-day period described in paragraph (1) expires and the collection activities have not ceased or the debtor has not received written notice that collection activities have ceased.

(ii) The debtor receives written notice pursuant to paragraph (4) of subdivision (d) of the claimant’s good faith determination that the information does not establish that the particular debt, or portion thereof, is coerced debt.

(5) For purposes of this subdivision, the 30-day period shall begin to run when the claimant receives the written notice.

(g) A claimant that ceases collection activities under this section and does not recommence those collection activities shall do both of the following:

(1) If the claimant has furnished adverse information to a consumer credit reporting agency regarding the debtor and a particular debt, or portion thereof, notify the agency to delete that information no later than 10 business days after making its determination.

(2) If the claimant is a debt collector, notify the creditor no later than 10 business days after making its determination that collection activities have been terminated based upon the debtor’s assertion that a particular debt, or portion thereof, being collected is coerced debt.

(h) A claimant that has possession of documents that the debtor is entitled to request from a creditor pursuant to Section 530.8 of the Penal Code may provide those documents to the debtor.

title: 1.81.35. Coerced Debt


text:
(a) (1) A debtor may bring an action against a claimant to establish that a particular debt, or portion thereof, is coerced debt.

(2) In an action brought by a claimant to recover a particular debt against the debtor, the debtor may file a cross-complaint to establish that the particular debt, or portion thereof, is coerced debt. The notice described in subdivision (f) of Section 1798.97.2 shall not be required as a prerequisite to filing a cross-complaint.

(3) A debtor shall plead the allegations of coerced debt with particularity and shall do either of the following:

(A) Attach the documents provided to the claimant pursuant to subdivision (b) of Section 1798.97.2 to any complaint.

(B) Attach the documents identified in subdivision (b) of Section 1798.97.2 to any cross-complaint.

(b) If the debtor establishes by a preponderance of the evidence in an action described in subdivision (a) that the particular debt, or portion thereof, is coerced debt, the debtor shall be entitled to the following relief:

(1) A declaratory judgment that the debtor is not obligated to the claimant on the particular debt, or portion thereof, that is coerced debt.

(2) An injunction prohibiting the claimant from holding or attempting to hold the debtor personally liable on the particular debt, or portion thereof, that is coerced debt, and prohibiting the claimant from enforcing a judgment related to the particular debt, or portion thereof, that is coerced debt against the debtor.

(3) An order dismissing any cause of action brought by the claimant to enforce or collect on the particular debt from the debtor or, if only a portion of the debt is established as coerced debt, an order directing that the complaint and judgment, if any, in the action be amended to reflect only the portion of the particular debt that is not coerced debt.

(c) (1) If the debtor establishes by a preponderance of the evidence in an action described in subdivision (a) that the particular debt, or portion thereof, is coerced debt, the court shall issue a judgment in favor of the claimant against the person or persons who coerced the debtor into incurring the debt in the amount of the debt, or portion thereof, that is coerced debt, provided that the person or persons who coerced the debtor into incurring the debt or debts has been brought within the jurisdiction of the court and joined as a party to the action and the evidence supports such a judgment.

(2) The court presiding over the action shall take appropriate steps necessary to prevent abuse, as defined in Section 6203 of the Family Code, of the debtor or an immediate family member of the debtor, including, but not limited to, sealing court records, redacting personally identifiable information about the debtor and any immediate family member of the debtor, and directing that any deposition or evidentiary hearing be conducted remotely.

(d) A debtor who files knowingly false motions, pleadings, or other papers or engages in other tactics that are frivolous or intended to cause unnecessary delay against a claimant shall be liable for the claimant’s attorney’s fees and costs in defending the lawsuit.

(e) The claimant may move the court to make written findings regarding evidence related to the person who caused the coerced debt to be incurred.

(f) Where some or all of a claim is established as having arisen from coerced debt, a claimant shall have standing, and may use all rights and remedies, to collect by any lawful means that claim, or portion thereof, from the person or persons determined to have coerced the debt, or against a person who used or possessed money, goods, services, or property obtained through coerced debt.

(g) The statute of limitations for a claimant to bring an action to collect coerced debt from any person determined to have coerced the debt shall run from the date of the court’s determination that the person caused the duress, intimidation, threat of force, force, fraud, or undue influence giving rise to the coerced debt at issue and shall be brought within five years of that determination.

title: 1.81.35. Coerced Debt